remcos | 52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7

General

Target

52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe
Size

475KB
MD5

161f3aae8e9907b33cbd59c7f01c1840
SHA1

cd818470eaff911027b2c8834561f83b725af8e9
SHA256

52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7
SHA512

63f7ae2013c8bc5c3a5403683e162d5aa32dd6eff9ef2035aa09254b55c79ef9e9f8fb7257a22c2b0fd912ca0a4b63273aa9d016e916bac7263774f55ff5b0fb
SSDEEP

12288:JjdAK8wxqkXuxOqLXO3X2orpbKs/ZglBRq:XA3wxqkXuxOq+rpbRZO

Score

10^/10

remcos remotehost evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NB4WGA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe

Executes dropped EXE 1 IoCs

pid	Process
4452	remcos.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4452 set thread context of 4476	4452	remcos.exe	71

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4284	reg.exe
4348	reg.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4452	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4452	remcos.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3748	3144	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe	66
PID 3144 wrote to memory of 3748	3144	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe	66
PID 3144 wrote to memory of 3748	3144	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe	66
PID 3748 wrote to memory of 4284	3748	cmd.exe	68
PID 3748 wrote to memory of 4284	3748	cmd.exe	68
PID 3748 wrote to memory of 4284	3748	cmd.exe	68
PID 3144 wrote to memory of 4452	3144	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe	69
PID 3144 wrote to memory of 4452	3144	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe	69
PID 3144 wrote to memory of 4452	3144	52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe	69
PID 4452 wrote to memory of 4164	4452	remcos.exe	70
PID 4452 wrote to memory of 4164	4452	remcos.exe	70
PID 4452 wrote to memory of 4164	4452	remcos.exe	70
PID 4452 wrote to memory of 4476	4452	remcos.exe	71
PID 4452 wrote to memory of 4476	4452	remcos.exe	71
PID 4452 wrote to memory of 4476	4452	remcos.exe	71
PID 4452 wrote to memory of 4476	4452	remcos.exe	71
PID 4164 wrote to memory of 4348	4164	cmd.exe	73
PID 4164 wrote to memory of 4348	4164	cmd.exe	73
PID 4164 wrote to memory of 4348	4164	cmd.exe	73

C:\Users\Admin\AppData\Local\Temp\52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe
"C:\Users\Admin\AppData\Local\Temp\52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:4284
- C:\ProgramData\Remcos\remcos.exe
  "C:\ProgramData\Remcos\remcos.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4348
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:4476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\logs.dat

Filesize
144B

MD5
d9a99171f10c83c21225f963f93beb1d

SHA1
57140631122e68bdfe8191c8da323f83966c8d55

SHA256
6dddd9e631f6c5add844e08ff2b575a76790c545ae99fdc620e443e3e2957822

SHA512
bf1b4cb92d15a311324700c4b0dc391dbd87637b51cf0af35d800c4f165b7e95c06459ba321c181323c3c749c9b59fa8528f6073200dbad86eae0f97a9baa30d

Download Submit
C:\ProgramData\Remcos\remcos.exe

Filesize
475KB

MD5
161f3aae8e9907b33cbd59c7f01c1840

SHA1
cd818470eaff911027b2c8834561f83b725af8e9

SHA256
52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7

SHA512
63f7ae2013c8bc5c3a5403683e162d5aa32dd6eff9ef2035aa09254b55c79ef9e9f8fb7257a22c2b0fd912ca0a4b63273aa9d016e916bac7263774f55ff5b0fb

Download Submit
C:\ProgramData\Remcos\remcos.exe

Filesize
475KB

MD5
161f3aae8e9907b33cbd59c7f01c1840

SHA1
cd818470eaff911027b2c8834561f83b725af8e9

SHA256
52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7

SHA512
63f7ae2013c8bc5c3a5403683e162d5aa32dd6eff9ef2035aa09254b55c79ef9e9f8fb7257a22c2b0fd912ca0a4b63273aa9d016e916bac7263774f55ff5b0fb

Download Submit
C:\ProgramData\Remcos\remcos.exe

Filesize
475KB

MD5
161f3aae8e9907b33cbd59c7f01c1840

SHA1
cd818470eaff911027b2c8834561f83b725af8e9

SHA256
52cd7be7efd8e79b7b6858ea23f0693e2fefdf5f903fe961b271873ddc924ff7

SHA512
63f7ae2013c8bc5c3a5403683e162d5aa32dd6eff9ef2035aa09254b55c79ef9e9f8fb7257a22c2b0fd912ca0a4b63273aa9d016e916bac7263774f55ff5b0fb

Download Submit
memory/4476-146-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4476-149-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4476-150-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4476-151-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads